Client-side scanning is a targeted solution for customers who want to leverage Artifactory scanning but do not want to upload their artifacts over the Internet.
What does it do?
The Client-side scanner is scass-scanner running on the client side. The key difference lies in the source of the BDIO file and the destination for uploading the produced BDIO.
SCASS Scanner does three main things:
-
Scans the desired files and creates a BDIO with the results.
-
Uploads the BDIO to Google bucket.
-
Sends back scan upload status to the Artifactory plugin.
The /api/upload/ endpoint in the scanner allows clients, such as
Artifactory, to upload scans. It supports multipart form requests, enabling the
submission of the artifact to be scanned and the uploading of the resulting BDIO.
SCASS scanner readiness and fault tolerance
The SCASS Scanner uses readiness probes as intended. In a deployment with multiple replicas, if one instance of scass-scanner is running a scan, its readiness state will be set to false. This ensures that Kubernetes does nto send any additional requests to that scanner, thereby achieving high fault tolerance.
HTTP return codes in SCASS scanner
The SCASS Scanner uses various HTTP return codes to indicate the status of requests. Possible return codes include:
-
HTTP 429 - TOO_MANY_REQUESTS→ if the scanner is running a scan. -
HTTP 422 - UNPROCESSABLE_ENTITY→ if the uploaded artifact is invalid. -
HTTP 400 - BAD_REQUEST→ if the upload url is bad / any errors uploading to gcp. -
HTTP 500 - INTERNAL_SERVER_ERROR→ if there are any unforeseen errors.